Security breach on PinePhone UBports SMS

[daniel]

I don't know if this is occurring on the UBports end of things or the carrier end, but this is a somewhat concerning security bug.

I can send but do not receive SMS messages, I'm on dev channel, up to date as of today. I've filed a bug on that elsewhere. A couple of times a day I message my wife to see if she gets mine and to see if I get her reply. I never do. Today, I messaged her and she replied to the received message. I did not receive her reply, though her iPhone noted that the message had been received. She then got a message saying "Who is this?" to which she responded "It's your wife," and then a reply back saying "Huh?"

I did not receive any of her messages, nor did I receive any of the replies to those messages from whoever was sending them.

About 20 minutes after that, I DID receive a text message. It was an automated message from Venmo (or purporting to be so), with a 2-factor authorization code. That is the only text message I have received in several weeks. I have never had a venmo account.

My wife is using an iPhone, recent version, never has had any difficulties with SMS.

Can somebody explain to me what is going on, and how to fix it? I mean, like ASAP? I have no idea how much of my data is being compromised.

I am, to put it mildly, a little bit freaked.

This is concerning. I *hope* it is just a simple bug but important to be cautious.

it may just be  bug but here is suggestion: disable 2g. may be unrelated but 2g imsi catchers (stingrays that can act as man in middle) are the most common/accessible.  Something everyone might want to do to prevent 2g imsi attacks.

The venmo 2fa sms reminds me of what I have read on sim jacking

Everyone should at least be aware of this vulnerability in current sim cards allowing the hijacking of phone numbers/phones.
Read more about it here: https://thehackernews.com/2019/09/simjac...cking.html

I'm not sure if it depends on mms or if it can be done via simple sms, but apparently it is used for surveillance/contactors/hackers, many times specifically targeting users for one reason or another. And as the article states just about *all phones* are vulnerable because it is the sim card itself that has the vulnerability (sim card has its own java browser!).

I really hope this is just a bug and not related to a sim card vulnerability.

One thing sim jacker hackers tend to do is try to access bank accounts/other financial services. sms 2fa becomes a problem when the jacker gets ahold of accounts using their cell phone sms as security (other forms of 2fa are suggested until sim cards are replaced).

I hope it is just some type of "crossing lines bug" but I would take a look at your bank account- if it is an attacker they may use various "lost my password send a txt" feature *if* it is some kind of attack that has access to your txts.

You may want to temp take your cell phone number off bank account/other important phone number linked accounts for the time being if worried. Let's hope it's not a targeted attack on you personally.

Thanks for making us aware. Btw did you see any other strange activity? Were there any strange links sent to you/anyone you know?  There are rumors of T-Mobile being especially common for sim jackings (in case you have T-Mobile: some believe there are employee insiders assisting).

Hopefully it is just a software vulnerability (but the venmo 2fa code is strange).

Oh wow! Reading this, better I do not put my SIM in PP. We better buy a cheap prepaid sim for testing PP until can be used securely.

Thanks for the warning!